Last updated 30 October 2026
These are the third parties that ForeAct Labs, LLC uses to process customer personal data for the hosted Open Executive service, under the Data Processing Addendum. Each is bound by a written agreement with data-protection terms at least as protective as ours.
We give customers at least 30 days' notice of a new subprocessor by email, and update this page. To object, write to support@openexecutive.ai before the change takes effect (see section 6 of the DPA).
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Fly.io, Inc. | Cloud hosting: the platform, its memory service, each customer's isolated instance, and the isolated environments that run code and host apps for each customer (compute and encrypted storage) | All Customer Content and account data | United States |
| Tigris Data, Inc. | Storage of instance backups | Backup archives of Customer Content | United States |
| OpenRouter, Inc. | AI model gateway: routes each model request to the provider serving the chosen model | Prompts, the Customer Content included in them, and model responses | United States |
| Anthropic, PBC | AI models (Claude), reached through OpenRouter | Prompts, the Customer Content included in them, and model responses | United States |
| Amazon Web Services, Inc. and Google LLC | Cloud hosting of Claude models (Amazon Bedrock, Google Vertex AI), when OpenRouter routes a Claude request to them | Prompts, the Customer Content included in them, and model responses | United States |
| Other AI model providers, such as OpenAI, Google, xAI, Mistral AI, and hosts of Meta Llama and DeepSeek models | Only when a customer chooses a model that is not Claude: the provider OpenRouter routes that model's requests to. When such a model cannot read a PDF itself, Mistral AI's document reader extracts its text | Prompts, the Customer Content included in them, and model responses | United States, or another country where the chosen provider operates |
| Recall.ai, Inc. | Meeting bots: joins the video calls you send the Executive to (Google Meet, Zoom, Microsoft Teams), transcribes them live, and speaks and posts in the call's chat for the Executive | The call's audio, video and chat, its transcript, and participants' names. The recording is deleted after the call unless your organization chooses to keep recordings | United States |
| OpenAI, L.L.C. | Live voice in meetings: the realtime model that hears and answers in calls and in-app voice calls, and turns the Executive's replies into speech | The call's audio and the meeting context included in the request, and the model's spoken and text responses | United States |
| Stripe, Inc. | Payments, subscriptions, invoicing and tax; may act as merchant of record | Billing contact and address, payment details, subscription status | United States |
| Plus Five Five, Inc. (Resend) | Delivery of service emails, and receiving email sent to an instance's platform address | Sender and recipient email addresses and the email's content, including attachments (received email is kept up to 30 days) | United States |
| 650 Industries, Inc. (Expo) | Delivery of notifications to the mobile app, passed on to Apple's and Google's push services | The phone's push token and the notification's short text | United States |
| Functional Software, Inc. (Sentry) | Error tracking: reports of errors in the platform, each customer's instance and the web app, so we can fix them | Error details (the failing code and a short error message, with email addresses, tokens and request contents removed) and the instance's internal id | United States |
Services you choose to connect
When you connect a service to your instance — for example Google Workspace (Gmail, Calendar, Drive, Chat), Microsoft 365 (Outlook, Teams, OneDrive), Slack, Notion, Confluence, Discord, Telegram, or your own Anthropic or OpenAI API key — your instance exchanges data with it on your instructions.
Business apps (for example HubSpot, Asana, Linear or Stripe) connect through each vendor's own hosted connector. For these, our platform keeps the access token, encrypted, and makes the calls for your instance, which never holds the token. Reading runs straight away; any change waits for your approval.
These services act under your own agreement with them, not as our subprocessors.
Sign in with Google or Microsoft
If you choose Sign in with Google, Google confirms your identity and shares your name, email address and profile picture with us. If you choose Sign in with Microsoft, Microsoft confirms your identity and shares your name, email address, and your Microsoft organization and user IDs with us. Each acts as an independent controller.